CVE-2026-106043

Executive Summary

CVE-2026-106043 is a Missing Authentication for Critical Function vulnerability (CWE-306) in Ivanti Xtraction affecting versions before 2026.4. A remote, unauthenticated attacker can exploit the flaw to create and modify a "trusted site," indicating that a security-critical configuration function is exposed without an authentication check. With a CVSS base score of 7.5 (High), the confirmed impact is limited to integrity (I:H) with no direct confidentiality or availability impact, but the ability to alter trusted-site configuration may enable follow-on compromise such as trust-boundary bypass, malicious content injection, or redirection of users to attacker-controlled infrastructure. No public PoC, exploit code, Nuclei template, or CISA KEV listing currently exists, and no patch has been confirmed from tracked sources.

Technical Analysis

The vulnerability class is CWE-306, Missing Authentication for Critical Function. Per the NVD description, Ivanti Xtraction versions prior to 2026.4 expose a critical function that permits an unauthenticated remote party to "create, modify, trusted site" — that is, the trusted-sites configuration is writable without any authentication or authorization gate.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N provides the authoritative profile of the flaw:

• AV:N (Network) — the vulnerable function is reachable over the network; no local or adjacent access is required.
• AC:L (Low) — no special conditions, race windows, or complex preconditions are described; the attacker can trigger the flaw reliably.
• PR:N (None) — no credentials or prior authentication are required. This is the defining characteristic of a CWE-306 issue: the endpoint or handler performs a sensitive operation without any authentication check at all, as opposed to an authorization-logic flaw that requires a valid but under-privileged account.
• UI:N (None) — no victim interaction is required for the vulnerability itself to be triggered.
• S:U (Unchanged) — the exploit does not cross a privilege/security scope boundary as scored, meaning the impacted component remains the same one hosting the vulnerable function.
• C:N / I:H / A:N — confidentiality and availability impacts are scored as none; integrity impact is High. This is consistent with an attacker being able to insert or alter trusted-site entries, modifying security-relevant configuration data, without (as scored) directly reading sensitive data or causing denial of service.

"Trusted site" configuration is security-critical by definition: trusted-site lists commonly govern which external origins, domains, or hosts are implicitly accepted by the product (for example for embedded content, redirect targets, or allow-listed navigation). A missing authentication check on the function that manages this list therefore gives an unauthenticated attacker the ability to manipulate the product's own trust decisions.

Because the NVD description does not specify the HTTP method, endpoint path, parameter names, request body structure, or transport details of the vulnerable function, no code-level reproduction detail can be stated with accuracy. The analysis above is bounded by the vulnerability class and the CVSS profile; specific implementation internals are not available in the provided data. Likewise, the exact meaning and downstream consumption of the "trusted site" object within Xtraction is not documented in the supplied description and is not asserted here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-306) and the stated outcome (unauthenticated creation/modification of a trusted site). No specific endpoint, parameter, or payload is asserted because none is provided in the source data.

1. Reconnaissance / target identification. An attacker identifies internet- or intranet-reachable Ivanti Xtraction deployments running a version earlier than 2026.4. Discovery is consistent with broad scanning for the product's HTTP interfaces (see Shodan dorks). No credentials are needed, so unauthenticated enumeration is sufficient to confirm the product and version where the service advertises that information.

2. Triggering the flawed class of function. The attacker sends a network request to the product's critical configuration function responsible for managing trusted sites. Because authentication is missing (CWE-306), the request is processed without any credential, session, or token being presented. The attack surface is the web/API interface hosting this configuration function; the specific path and verb are not disclosed in the provided data.

3. Payload / execution at the vulnerability-class level. The attacker supplies data that creates or modifies a trusted-site entry — i.e., a configuration write that adds or alters a trust entry. There is no memory-corruption or code-execution step implied by the CVSS profile (integrity-only). The "payload" is configuration content: a new or modified trusted-site record.

4. Post-exploitation impact. Having injected or altered a trusted-site entry, the attacker gains a persistent manipulation of the product's trust configuration. Depending on how Xtraction consumes that list, plausible downstream effects include: trust-boundary bypass (the product accepting a value it would otherwise reject), injection of attacker-controlled content or origin into a trusted context, or abuse of the entry during later interactions with users or dependent systems. The scored direct impact is integrity-only; any confidentiality or availability consequence would be a subsequent, chained effect not reflected in this CVE's CVSS.

Constraint acknowledged: the supplied description is sparse. The precise request format, endpoint, and how the persisted trusted-site value is later used are not specified in the data, and this report does not fabricate them.

Impact Assessment

Direct impact (per CVSS): Integrity: High. An unauthenticated remote attacker can create and modify trusted-site configuration. No confidentiality or availability impact is scored.

Business impact: Trusted-site configuration is a security control. Unauthorized modification can weaken the product's trust posture, potentially enabling subsequent attacks that rely on the product treating attacker-influenced origins or entries as trusted. In defensively configured environments the product may sit on internal networks where its trust list is consumed by identity, SSO, or content-embedding workflows; tampering there can undermine those controls even without direct data exfiltration in this single step.

Affected systems: Ivanti Xtraction instances earlier than version 2026.4. Exact deployment populations and whether the vulnerable function is exposed only on the web UI, an API, or both are not specified in the provided data.

Blast radius: Reachability depends on network exposure. Because the vector is AV:N/PR:N, any instance whose trusted-site management function is reachable from an untrusted network segment is at risk without any credential. Internet-facing instances carry the greatest exposure; internal instances remain at risk from any host that can route to the interface.

Severity context: CVSS 7.5 = High. No EPSS score is available (not yet scored by FIRST.org), no CISA KEV listing, and no public exploit code — so current exploitation likelihood cannot be corroborated by those sources.

Detection Guidance

Detection should focus on unauthenticated requests touching the trusted-site management function and on unexpected modifications to trusted-site configuration. Because the exact endpoint, parameters, and log format are not provided in the source data, the rules below are written to be templated to the environment; placeholders for hostnames, log sources, and field names must be adjusted to match the deployed Xtraction logging and web-proxy telemetry.

Sigma Rule

title: Ivanti Xtraction Unauthenticated Trusted Site Modification (CVE-2026-106043)
id: 8c1f3d92-4b7a-4f01-9c2e-ivantixtr106043
status: experimental
description: Detects unauthenticated requests that create or modify trusted-site configuration in Ivanti Xtraction before 2026.4 (CWE-306 missing authentication).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106043
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: ivanti
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
      - PATCH
  selection_path:
    cs-uri-stem|contains:
      - 'trusted'
      - 'trustedsite'
      - 'trusted-site'
  selection_noauth:
    cs-username: null
    sc-status:
      - 200
      - 201
      - 204
  condition: selection_method and selection_path and selection_noauth
falsepositives:
  - Legitimate administrative configuration changes (should be authenticated; investigate if not)
level: high
tags:
  - attack.t1190
  - cwe.306

YARA Rule

rule CVE_2026_106043_Ivanti_Xtraction_Trusted_Site
{
    meta:
        description = "Detects references to unauthenticated trusted-site manipulation in Ivanti Xtraction context; heuristic, adjust to collected artifacts"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106043"
        cve = "CVE-2026-106043"
        date = "2026-01-01"

    strings:
        $s1 = "trusted site" nocase ascii wide
        $s2 = "trustedsite" nocase ascii wide
        $s3 = "trusted-site" nocase ascii wide
        $prod = "Xtraction" nocase ascii wide
        $ver = "2026.4" ascii wide

    condition:
        $prod and (any of ($s1, $s2, $s3)) and not $ver
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106043 Ivanti Xtraction Unauthenticated Trusted Site Modification Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"trusted"; nocase; http.uri; content:"site"; nocase; reference:cve,2026-106043; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106043; classtype:attempted-admin; sid:1060430; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where network.protocol == "http" and http.request.method in ("POST","PUT","PATCH")
      and wildcard(http.request.path, "*trusted*") ]
  [ network where network.protocol == "http"
      and http.response.status_code in (200,201,204) ]

Splunk SPL Query

index=web sourcetype=ivanti:xtraction OR sourcetype=access_combined
| search (uri_path="*trusted*" OR uri_path="*trustedsite*" OR uri_path="*trusted-site*")
| where method IN ("POST","PUT","PATCH")
| where status IN (200,201,204) AND (user="" OR user="-" OR user="anonymous")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, method, status
| sort - count

Wazuh OSSEC Rule

<group name="ivanti,xtraction,web,">
  <rule id="106043" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">trusted</field>
    <regex field="url">trusted-site|trustedsite|trusted site</regex>
    <regex field="method">POST|PUT|PATCH</regex>
    <description>CVE-2026-106043: Possible unauthenticated Ivanti Xtraction trusted-site modification attempt.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is confirmed in the provided data.

1. Immediate mitigations (compensating controls).

   • Restrict network access to the Xtraction management/trusted-site function. Place it behind authentication-enforcing reverse proxies, VPN, or zero-trust access; block untrusted and internet-facing reachability.
   • Enforce authentication and authorization at a fronting layer (reverse proxy / API gateway / WAF) for all requests to configuration functions, since the application-layer check is missing (CWE-306).
   • Apply WAF rules that reject unauthenticated POST/PUT/PATCH requests directed at configuration paths containing "trusted" tokens.
   • Segment Xtraction deployments so that only known administrative hosts can reach configuration interfaces.
   • Monitor and baseline the trusted-site list; alert on unexpected changes and validate entries against an approved allow-list.

2. Patch / upgrade steps.

   • Upgrade to Ivanti Xtraction version 2026.4 or later, the version identified as fixed for this issue in the provided data.
   • Because no vendor advisory URL or patch artifact is confirmed in the supplied data, verify the fix and available upgrade guidance directly with Ivanti through official channels before relying on the version number alone.
   • After upgrading, re-audit the trusted-site list and revert any unauthorized entries that may have been introduced pre-patch, since an upgrade does not automatically remediate prior configuration tampering.

3. Long-term hardening.

   • Treat all security-critical configuration functions as authenticated by default; perform code review and threat-modeling against CWE-306 to find other unauthenticated critical functions.
   • Implement defense-in-depth authentication at the perimeter so a single missing application-layer check does not result in an unauthenticated, network-reachable sensitive action.
   • Enforce configuration integrity monitoring and change auditing for trust-affecting settings.
   • Maintain an inventory and exposure map of all externally reachable management/config interfaces to enable rapid response when new CWE-306 issues are disclosed.

References

• NVD — CVE-2026-106043: https://nvd.nist.gov/vuln/detail/CVE-2026-106043
• MITRE CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Ivanti Security Advisories (verify current guidance directly with the vendor; no specific advisory URL confirmed in provided data): https://www.ivanti.com/security
• FIRST EPSS — CVE-2026-106043 (not yet scored at time of writing): https://api.first.org/data/v1/epss?cve=CVE-2026-106043

Threat actor campaigns / exploit-in-the-wild: none confirmed in the provided data. No CISA KEV listing, no public PoC, no exploit code, and no Nuclei template are known for this CVE at the time of writing.